feat(convex-dev-better-auth): add pr329 cached token rotation patches

README.md

@@ -20,6 +20,7 @@ PRs still in flight. Every row has a patch in `packages/` you can drop into your
 | :--- | :--- | :--- | :--- |
 | [`bun`](packages/oven-sh/bun/) | `1.3.14` | Drop the order-dependent peer-dep early-match block from `get_or_put_resolved_package` so `bun.lock` stops varying run to run. The block bound peers to whichever same-name resolution `package_index` held first, and `package_index` fills in thread-pool-completion order. Dedup and the "incorrect peer dependency" warning move into `Tree::hoist_dependency` where placement is deterministic. Rust port of Dylan's [#29804](https://github.com/oven-sh/bun/pull/29804). | [oven-sh/bun#30855](https://github.com/oven-sh/bun/pull/30855) |
 | [`@convex-dev/better-auth`](packages/@convex-dev/better-auth/) | `0.12.2` | Wrap `fetchAccessToken` in `new Promise()` so `useConvexAuth().isAuthenticated` flips after sign-in on Hermes V1. The Expo SDK 56 canary dropped `@babel/plugin-transform-async-to-generator` from its Hermes V1 preset ([expo/expo#45345](https://github.com/expo/expo/pull/45345)), exposing a bridge race the transform's extra tick was hiding. Babel-layer root fix in [facebook/react-native#56816](https://github.com/facebook/react-native/pull/56816). | [get-convex/better-auth#368](https://github.com/get-convex/better-auth/pull/368) |
+| [`@convex-dev/better-auth`](packages/@convex-dev/better-auth/) | `0.12.2` | Drop the cached JWT when `authClient.useSession().session.id` changes. The React hook returned the stale token until logout, so `convex/react`'s `useConvexAuth` held a JWT whose `sub` pointed at a deleted session for the half-second between `/change-password` rotating sessions and the next `forceRefreshToken`. Track `sessionId` in a ref, compare on every `fetchAccessToken`, clear both `cachedToken` and `pendingTokenRef` on rotation. Pairs with [better-auth/better-auth#9345](https://github.com/better-auth/better-auth/pull/9345). | [get-convex/better-auth#329](https://github.com/get-convex/better-auth/pull/329) |
 | [`@react-native/babel-preset`](packages/@react-native/babel-preset/) | `0.85.3` | Three Babel plugins that rewrite source patterns Hermes V1 mishandles: `async ({a}) =>` (await resolves with `undefined` while the body keeps running), `class` inside `finally` (IR-cache contamination), and `super.x` in object-accessor identifier keys (segfaults at IR generation). Port of [@kitten](https://github.com/kitten)'s plugins from `babel-preset-expo` ([expo/expo#45601](https://github.com/expo/expo/pull/45601)) so bare RN consumers escape the bugs without `babel-preset-expo`. Root cause: [facebook/hermes#1761](https://github.com/facebook/hermes/issues/1761). | [facebook/react-native#56816](https://github.com/facebook/react-native/pull/56816) |
 | [`better-auth`](packages/better-auth/) | `1.6.11` | Preserve the caller's session on `/change-password` with `revokeOtherSessions: true`. Same family as [#9087](https://github.com/better-auth/better-auth/pull/9087). | [better-auth/better-auth#9345](https://github.com/better-auth/better-auth/pull/9345) |
 | [`@hugeicons/react`](packages/@hugeicons/react/) | `1.1.6` | Ship subpath types for `@hugeicons/core-free-icons/*` so TS finds them under `node16`, `nodenext`, and `bundler` resolution. Vite dev stops pre-bundling the 6.2 MB barrel for the 33 KB you actually use. | [hugeicons/react#5](https://github.com/hugeicons/react/pull/5) |